package apperr

import (
	"regexp"
	"strings"
)

// Sanitisation is a floor, not a guarantee (spec §3.1): the patterns below
// catch what secrets look like in practice — addresses, bearer tokens,
// key=value credentials, long opaque runs — before anything is buffered.
var (
	reEmail = regexp.MustCompile(`[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}`)
	reAuth  = regexp.MustCompile(`(?i)\b(bearer|basic)\s+[A-Za-z0-9._~+/=-]+`)
	// key=value and "key": "value" shapes, value up to the next delimiter.
	reKV = regexp.MustCompile(`(?i)\b(token|key|secret|password|passwd|pwd|api_key|apikey|access_token|auth)("?\s*[=:]\s*"?)[^\s&"',;]+`)
	// reLongCandidate finds runs of 32+ characters that COULD be a
	// redacted secret: a digest, a token, a base64 blob. It deliberately
	// over-matches — an absolute path (/app/node_modules/.../index) and a
	// long camelCase identifier both fit this shape — because
	// looksLikeSecretToken, not the regex, decides what actually gets
	// redacted.
	reLongCandidate = regexp.MustCompile(`\b[A-Za-z0-9+/_-]{32,}={0,2}`)
	// reHexOnly is a candidate that is nothing but hex digits: a digest.
	reHexOnly = regexp.MustCompile(`^[0-9a-fA-F]{32,}$`)
)

// looksLikeSecretToken reports whether a run already matched by
// reLongCandidate actually looks like a hex digest or a base64 blob,
// rather than an ordinary path or a long identifier. A hex digest is all
// [0-9a-fA-F]. A base64 blob either mixes a digit, an upper-case letter
// and a lower-case letter, or carries a base64-only character (+ or the =
// padding) — a bare / is treated as a base64 signal only when the token
// has no "." and is not itself a path segment, since both a
// node_modules path segment and an absolute path contain "/" without
// being base64. precededBySlash is true when the character immediately
// before the match in the original string is "/": \b never matches
// between two non-word characters, so an absolute path's candidate token
// starts right after its leading "/", not with it — precededBySlash is
// how the caller hands back the "starts with /" signal the regex itself
// can't capture.
func looksLikeSecretToken(tok string, precededBySlash bool) bool {
	if reHexOnly.MatchString(tok) {
		return true
	}
	hasDigit := strings.ContainsAny(tok, "0123456789")
	hasUpper := strings.ContainsAny(tok, "ABCDEFGHIJKLMNOPQRSTUVWXYZ")
	hasLower := strings.ContainsAny(tok, "abcdefghijklmnopqrstuvwxyz")
	if hasDigit && hasUpper && hasLower {
		return true
	}
	if strings.ContainsAny(tok, "+=") {
		return true
	}
	if strings.Contains(tok, "/") && !strings.Contains(tok, ".") && !precededBySlash {
		return true
	}
	return false
}

// Sanitize redacts secrets in free text: messages, stacks, field values.
func Sanitize(s string) string {
	s = reEmail.ReplaceAllString(s, "<email>")
	s = reAuth.ReplaceAllStringFunc(s, func(m string) string {
		word := m[:strings.IndexAny(m, " \t")]
		return word + " <redacted>"
	})
	s = reKV.ReplaceAllString(s, "${1}${2}<redacted>")
	s = redactLongTokens(s)
	return s
}

// redactLongTokens replaces each reLongCandidate match that
// looksLikeSecretToken accepts with "<hex>", leaving the rest — an
// ordinary path or identifier — untouched. It walks matches by index
// (rather than ReplaceAllStringFunc) because looksLikeSecretToken needs
// to see the byte before the match to tell a path segment from a base64
// blob.
func redactLongTokens(s string) string {
	idxs := reLongCandidate.FindAllStringIndex(s, -1)
	if idxs == nil {
		return s
	}
	var b strings.Builder
	last := 0
	for _, m := range idxs {
		start, end := m[0], m[1]
		precededBySlash := start > 0 && s[start-1] == '/'
		if looksLikeSecretToken(s[start:end], precededBySlash) {
			b.WriteString(s[last:start])
			b.WriteString("<hex>")
			last = end
		}
	}
	b.WriteString(s[last:])
	return b.String()
}

var (
	reUUID    = regexp.MustCompile(`^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$`)
	reHex16   = regexp.MustCompile(`^[0-9a-fA-F]{16,}$`)
	reB64ish  = regexp.MustCompile(`^[A-Za-z0-9+/_-]{20,}={0,2}$`)
	reEmailNW = regexp.MustCompile(`^[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}$`)
)

// SanitizePath strips query and fragment and collapses token-shaped
// segments to ":token" (spec §3.3): a UUID, a hex run of 16+, a base64-
// looking run of 20+, or an email. "/blog/2024-review" and "/orders/42"
// survive; "/reset/8f3a…" does not. Empty is "/".
//
// The base64 segment rule requires both a digit and an upper-case letter
// so that ordinary long slugs ("some-long-page-name-here") survive.
func SanitizePath(p string) string {
	if i := strings.IndexAny(p, "?#"); i >= 0 {
		p = p[:i]
	}
	if p == "" {
		return "/"
	}
	segs := strings.Split(p, "/")
	for i, s := range segs {
		if s == "" {
			continue
		}
		if reUUID.MatchString(s) || reHex16.MatchString(s) || reEmailNW.MatchString(s) ||
			(reB64ish.MatchString(s) && strings.ContainsAny(s, "0123456789") && strings.ContainsAny(s, "ABCDEFGHIJKLMNOPQRSTUVWXYZ")) {
			segs[i] = ":token"
		}
	}
	return strings.Join(segs, "/")
}